Cyber warfare a real threat, the US Secretary of Defense warns

The U.S. is facing a dramatically increasing threat from cyber attacks and a future attack on the country's critical infrastructure could have an effect similar to the September 11 terrorist attacks of 2001, the U.S. Secretary of Defense said last week.

DODLeon Panetta

Speaking at a meeting of the Business Executives for National Security (BENS) in New York Thursday night, Leon Panetta called the Internet "the battlefield of the future" and spelled out what he believes the Department of Defense's role should be in cyberspace.

The military's role in securing the domestic Internet and working against attacks on commercial institutions has been controversial, although Panetta sought to get the assembled business leaders on his side by warning them of the danger a large-scale attack could have on their companies.

"A cyber attack perpetrated by nation states or violent extremist groups could be as destructive as the terrorist attack on 9/11," he said in the televised speech. "Such a destructive cyber terrorist attack could virtually paralyze the nation." (See video of Panetta warning against future cyber attacks.)

Denial of service attacks cited

Panetta acknowledged recent distributed denial of service (DDOS) attacks on U.S. financial institutions that disrupted their websites and expressed concern with the speed at which they hit, but said he was even more alarmed by a recent attack by malware dubbed "Shamoon" that hit oil company Saudi Aramco.

"Shamoon included a routine called a 'wiper,' coded to self-execute," Panetta said. "This routine replaced crucial system files with an image of a burning U.S. flag. It also put additional 'garbage' data that overwrote all the real data on the machine. More than 30,000 computers it infected were rendered useless, and had to be replaced. It virtually destroyed 30,000 computers."

"All told, the Shamoon virus was probably the most destructive attack the private sector has seen to date," he said. "Imagine the impact an attack like that would have on your company."

Panetta told his audience the Department of Defense knows of specific instances where attackers have gained access to critical infrastructure systems and said such attacks could do great harm.

"An aggressor nation or extremist group could use these kinds of cyber tools to gain control of critical switches," he said. "They could for example derail passenger trains, or even more dangerous trains loaded with lethal chemicals," he said. "They could contaminate the water supply in major cities, or shut down the power grid across large parts of the country. The most destructive scenarios involve cyber actors launching several attacks on our critical infrastructure at one time in combination with a physical attack on our country."

Privacy concerns surface

Panetta first addressed one of the biggest issues surrounding increased military involvement with the Internet: the possibility that the Department of Defense would monitor personal e-mail and communications between U.S. citizens.

"That it not our goal, that is not our job, that is not our mission," he said. "Our mission is to defend the nation. We defend. We defer. And if called upon, we take decisive action to protect our citizens. In the past we have done so through operations on land and at sea, in the sky and in space. In this century, the United States military must help defend the nation in cyberspace as well." (See video of Panetta pledging not to monitor the communications of U.S. citizens.)

To do this, Panetta said the Department of Defense in investing more than US$3 billion per year in developing new capabilities to fight cyber attacks and said the U.S. has the capability to go on the offensive when required.

"If we detect an incoming attack that will cause significant physical destruction in the United States, or kill American citizens, we need to have the option to take action against those who would attack us, to defend this nation when directed by the president" Panetta said. "For these kinds of scenarios, the department has developed the capability to conduct effective operations to counter threats to our national interests in cyberspace."

Revising rules of engagement

As a result of the increased focus on cyber security by several government agencies, Panetta said the Department of Defense is in the final stages of revising its rules of engagement in cyberspace. The change is the largest in seven years and will spell out the duty of the military to defend its networks and also the nation should the U.S. come under major cyber attack.

Panetta closed with a call to his audience to share the responsibility to protect cyberspace.

"Ultimately, no one has a greater interest in cyber security than the business that depend on a safe, secure, and resilient global digital infrastructure," he said. "To defend those networks more effectively, we must share information between the government and private sector."

"We've made real progress in sharing information with the private sector, but very frankly, we need Congress to act to ensure that this sharing is timely and comprehensive. Companies should be able to share specific threat information with the government without the prospect of lawsuits hanging over their head. And a key principle must be to protect the fundamental liberties and privacy in cyberspace that we are all duty bound to uphold."